Software Security Research Articles

Hardware Security Risks and Threat Analyses in Advanced Manufacturing Industry

The advanced manufacturing industry (AMI) faces many unique challenges from the cyber-physical domain. Security threats are originated from two integral parts: software and hardware. Over the past decade, software security has been addressed extensively, but hardware security has not received enough attention. This work analyzes the security vulnerabilities of typical electronic devices deployed to AMI and proposes three attack models for sensing nodes, local storage and processing edge devices, and wired/wireless communication interfaces, respectively. Practical security attacks on hardware are demonstrated in this work to inspire the development of feasible countermeasures against hardware Trojans, fault injection attacks, and external signal interference. Moreover, this work highlights the unique security challenges posed by advanced manufacturing applications. To mitigate those security attacks in AMI, this work suggests guidelines for the defense method design that can effectively protect the hardware in AMI.

Balancing software and training requirements for information security

Information security is one of the key areas of consideration to assure reliable and dependable information systems (IS). Achieving an appropriate level of IS security requires concurrent consideration of the technical aspects of IS and the human aspects related to the end users of IS. These aspects can be described in the form of information security requirements. We propose an approach that helps select and balance information security software requirements (iSSR) and information security training requirements (iSTR) according to the information security performance of end users. The approach was tested in an experiment involving 128 IS professionals. The results showed that using the proposed approach helps IS professionals with limited experience in information security make significantly better decisions regarding iSSR and iSTR.

TSMAE: A Novel Anomaly Detection Approach for Internet of Things Time Series Data Using Memory-Augmented Autoencoder

With the development of the Internet of Things, it has been widely studied and deployed in industrial manufacturing, intelligent transportation, and healthcare systems. The time-series feature of the IoT makes the data density and the data dimension higher, where anomaly detection is important to ensure hardware and software security. However, the traditional anomaly detection algorithm has difficulty meeting this demand, not only in complexity but also accuracy. Sometimes the anomaly can be well reconstructed, resulting in a low reconstruction error. In this paper, we propose a memory-augmented autoencoder approach for detecting anomalies in IoT data, which aims to use reconstruction errors to determine data anomalies. First, a memory mechanism is introduced to suppress the generalization ability of the model, and a memory-augmented autoencoder TSMAE is designed for time-series data anomaly detection. Second, by adding penalties and derivable rectifier functions to loss to make the addressing vector sparse, memory modules are encouraged to extract typical normal patterns, thus inhibiting model generalization ability. Finally, through experiments on ECG and Wafer datasets, the validity of TSMAE is verified, and the rationality of hyperparameter setting is discussed through visualizing the memory module addressing vector.

Making existing software quantum safe: A case study on IBM Db2

The software engineering community is facing challenges from quantum computers (QCs). In the era of quantum computing, Shor's algorithm running on QCs can break asymmetric encryption algorithms that classical computers practically cannot. Though the exact date when QCs will become "dangerous" for practical problems is unknown, the consensus is that this future is near. Thus, the software engineering community needs to start making software ready for quantum attacks and ensure quantum safety proactively. We argue that the problem of evolving existing software to quantum-safe software is very similar to the Y2K bug. Thus, we leverage some best practices from the Y2K bug and propose our roadmap, called 7E, which gives developers a structured way to prepare for quantum attacks. It is intended to help developers start planning for the creation of new software and the evolution of cryptography in existing software. In this paper, we use a case study to validate the viability of 7E. Our software under study is the IBM Db2 database system. We upgrade the current cryptographic schemes to post-quantum cryptographic ones (using Kyber and Dilithium schemes) and report our findings and lessons learned. We show that the 7E roadmap effectively plans the evolution of existing software security features towards quantum safety, but it does require minor revisions. We incorporate our experience with IBM Db2 into the revised 7E roadmap. The U.S. Department of Commerce's National Institute of Standards and Technology is finalizing the post-quantum cryptographic standard. The software engineering community needs to start getting prepared for the quantum advantage era. We hope that our experiential study with IBM Db2 and the 7E roadmap will help the community prepare existing software for quantum attacks in a structured manner.

Enhancing Data Security and Predictive URL Analysis: A Comprehensive Approach to Preventing Data Breaches

Abstract: There has never been a time in history when starting and running a profitable business has been more difficult due to the upward trending rising trend in data breaches. Data breaches can have an immediate impact on hundreds of millions or conceivably billions of individualities in the data-driven world of the moment. Data breaches have grown in scope along with digital metamorphosis as attackers take advantage of our every data. Various measures are taken by many companies to control data breaches in order to prevent them. A business or firm may employ techniques like data encryption, human error, data backup and recovery, and data security software. In the case of middle-level and low-level organizations suffering the most cyber-attacks, Many businesses are successful in defending their data from intruders, typically large multinational corporations which engage a specialist and safeguard their own data. Therefore, we can employ some of the standard data breach prevention strategies in our project to ensure that the domain can receive its user data without any consequences. Our project proposes to improve data security where user data must reach their domain without any disruption.

Bug Bounty Hunting: A Case Study of Successful Vulnerability Discovery and Disclosure

This research is a case study on bug bounty hunting as a successful approach to finding and uncovering vulnerabilities in software. The purpose of this study is to understand the effectiveness of bug bounty hunting and its benefits in improving company security. Qualitative research methods were used by analyzing data from bug bounty programs that were successful in finding significant vulnerabilities. The results showed that bug bounty hunting proved to be effective in capturing various types of vulnerabilities, including web application vulnerabilities, network protocol vulnerabilities, hardware security vulnerabilities, and mobile app vulnerabilities. Security researchers play a critical role in the success of the bug bounty hunt, with their expertise in bug hunting and deep understanding of the technology. The benefits of bug bounty hunting include increased software security, cost efficiency, and increased company reputation for security and credibility. However, challenges such as finding hidden vulnerabilities and coordinating with enterprises need to be overcome. Recommendations include strengthening collaboration between enterprises and security researchers, establishing effective communication channels, and proactively responding to vulnerability reports.

An Exploratory Study Gathering Security Requirements for the Software Development Process

Software development stands out as one of the most rapidly expanding markets due to its pivotal role in crafting applications across diverse sectors like healthcare, transportation, and finance. Nevertheless, the sphere of cybersecurity has also undergone substantial growth, underscoring the escalating significance of software security. Despite the existence of different secure development frameworks, the persistence of vulnerabilities or software errors remains, providing potential exploitation opportunities for malicious actors. One pivotal contributor to subpar security quality within software lies in the neglect of cybersecurity requirements during the initial phases of software development. In this context, the focal aim of this study is to analyze the importance of integrating security modeling by software developers into the elicitation processes facilitated through the utilization of abuse stories. To this end, the study endeavors to introduce a comprehensive and generic model for a secure software development process. This model inherently encompasses critical elements such as new technologies, human factors, and the management of security for the formulation of abuse stories and their integration within Agile methodological processes.

Software defect prediction method based on the heterogeneous integration algorithm

A software defect is a common cyberspace security problem, leading to information theft, system crashes, and other network hazards. Software security is a fundamental challenge for cyberspace security defense. However, when researching software defects, the defective code in the software is small compared with the overall code, leading to data imbalance problems in predicting software vulnerabilities. This study proposes a heterogeneous integration algorithm based on imbalance rate threshold drift for the data imbalance problem and for predicting software defects. First, the Decision Tree-based integration algorithm was designed following sample perturbation. Moreover, the Support Vector Machine (SVM)-based integration algorithm was designed based on attribute perturbation. Following the heterogeneous integration algorithm, the primary classifier was trained by sample diversity and model structure diversity. Second, we combined the integration algorithms of two base classifiers to form a heterogeneous integration model. The imbalance rate was designed to achieve threshold transfer and obtain software defect prediction results. Finally, the NASA-MDP and Juliet datasets were used to verify the heterogeneous integration algorithm’s validity, correctness, and generalization based on the Decision Tree and SVM.

Towards data security assessments using an IDS security model for cyber-physical smart cities

Technology has enabled many devices to exchange huge amounts of data and communicate with each other as Edge Intelligence in Smart Cities (EISC), as a result of rapid technological advancements. When dealing with personal data, it is paramount to ensure that it is not disclosed and that there is no disclosure of any confidential information. In recent decades, academics and industry have spent considerable time and energy discussing security and privacy. Other systems, known as intrusion detection systems, are required to breach firewalls, antivirus software, and other security equipment to provide complete system security in smart operation systems. There are three aspects to an intrusion detection system: the intrusion detection method, the architecture, and the intrusion response method. In this study, we combined linear correlation feature selection methods and cross-information. The database used in this article is KDD99. This paper examines applying two feature selection methods in predicting attacks in intrusion detection systems based on INTERACT and A multilayer perceptron (MLP). Since the number of records associated with each attack type differs, one of our suggestions is to continue using data balancing techniques. As a result, the number of records associated with each type of network status becomes closer together. The results in the categories can also be improved using information synthesis methods, such as majority voting.

MT-SOTA: A Merkle-Tree-Based Approach for Secure Software Updates over the Air in Automotive Systems

The automotive industry has seen a dynamic transformation from traditional hardware-defined to software-defined architecture enabling higher levels of autonomy and connectivity, better safety and security features, as well as new in-vehicle experiences and richer functions through software and ongoing updates of both functional and safety-critical features. Service-oriented architecture plays a pivotal role in realizing software-defined vehicles and fostering new business models for OEMs. Such architecture evolution demands new development paradigms to address the increasing complexity of software. This is crucial to guarantee seamless software development, integration, and deployment—all the way from cloud or backend repositories to the vehicle. Additionally, it calls for enhanced collaboration between car manufacturers and suppliers. Simultaneously, it introduces challenges associated with the necessity for ongoing updates and support ensuring vehicles remain safe and up to date. Current approaches to software updates have primarily been implemented for traditional vehicle architectures, which mostly comprise specialized electronic control units (ECUs) designed for specific functions. These ECUs are programmed with a single comprehensive executable that is then flashed onto the ECU all at once. Different approaches should be considered for new software-based vehicle architectures and specifically for ECUs with multiple independent software packages. These packages should be updated independently and selectively for each ECU. Thus, we propose a new scheme for software updates based on a Merkle tree approach to cope with the complexity of the new software architecture while addressing safety and security requirements of real-time and resource-constrained embedded systems in the vehicle. The Merkle-tree-based software updates over the air (MT-SOTA) proposal enables secure updates for individual software clusters. These clusters are developed and integrated by diverse entities with varying release timelines. Our study demonstrates that the MT-SOTA scheme can enhance the speed of software update execution without significantly increasing the process overhead. Additionally, it offers necessary defense against potential cyberthreats. The results of the performed technical analysis and experiments of the MT-SOTA implementation are presented in this paper.

FPGA design and implementation for adaptive digital chaotic key generator

BackgroundInformation security is very important in today’s digital world, especially cybersecurity. The most common requirement in securing data in all services: confidentiality, digital signature, authentication, and data integrity is generating random keys. These random keys should be tested for randomness. Hardware security is more recommended than software. Hardware security has more speed and less exposure to many attacks than software security. Software security is vulnerable to attacks like buffer overflow attacks, side-channel attacks, and Meltdown–Spectre attacks.ResultsIn this paper, we propose an FPGA Implementation for the adaptive digital chaotic generator. This algorithm is proposed and tested before. We introduce its implementation as hardware. This algorithm needs a random number seed as input. We propose two designs. The first one has an input random number. The second one has PRNG inside. The target FPGA is Xilinx Spartan 6 xc6slx9-2-cpg196. We used MATLAB HDL Coder for the design. We propose a configurable Key block’s length. For 32 bit the maximum frequency is 15.711 MHz versus 11.635 MHz for the first and second designs respectively. The area utilization of the Number of Slice Registers is 1% versus 2%. The number of Slice Look Up Tables is 40% versus 59%. number of bonded input output blocks is 64% versus 66%. otherwise are the same for the two designs.ConclusionsIn this paper, we propose an efficient and configurable FPGA Design for adaptive digital chaotic key generator. Our design has another advantage of storing the output keys internally and reading them later.

Encryption in phase space for classical coherent optical communications

Optical layer attacks on optical fiber communication networks are one of the weakest reinforced areas of the network, allowing attackers to overcome security software or firewalls when proper safeguards are not put into place. Encrypting data using a random phase mask is a simple yet effective way to bolster the data security at the physical layer. Since the interactions of the random phases used for such encryption heavily depend on system properties like data rate, modulation format, distance, degree of phase randomness, laser properties, etc., it is important to determine the optimum operating conditions for different scenarios. In this work, assuming that the transmitter and the receiver have a secret pre-shared key, we present a theoretical study of security in such a system through mutual information analysis. Next, we determine operating conditions which ensure security for 4-PSK, 16-PSK, and 128-QAM formats through numerical simulation. Moreover, we provide an experimental demonstration of the system using 16-QAM modulation. We then use numerical simulation to verify the efficacy of the encryption and study two preventative measures for different modulation formats which will prevent an eavesdropper from obtaining any data. The results demonstrate that the system is secure against a tapping attack if an attacker has no information of the phase modulator and pre-shared key.

A novel and failsafe blockchain framework for secure OTA updates in connected autonomous vehicles

Connected Autonomous Vehicles (CAVs) are becoming data centers on wheels, amassing petabytes of data. They require a combination of software and hardware systems to operate reliably and simply in real-time. However, due to the transient nature of Vehicle to Vehicle (V2V) and Vehicle to Infrastructure (V2I) networks and CAVs' dependency on a connected software system, we need a new paradigm for secure and immutable data exchange, which emulates smart contracts. For this reason, CAV manufacturers need to maintain the latest version of software to protect CAVs from system failure and cyber threats in real-time, which is difficult with traditional centralized management. The key challenges that we must overcome are the authentication and secure sharing of the Over-The-Air (OTA) software updates and the scalability of distribution at the level of CAVs.This paper proposes a secure and scalable software updates framework in a distributed manner for the CAVs, leveraging Blockchain (BC) with smart contract technology. The framework is able to overcome slow processing speed, which is one of the significant limitations of BC in terms of lower latency and less packet overhead with a high level of security against possible cyber-attacks. We use a salting-based hashing scheme over the traditional Elliptic Curve Cryptography (ECC) Key. This process ensures multi-factor authenticated protection from malicious transactions while downloading and installing any new feature update in CAVs. Moreover, by using Hyperledger BC, our framework provides cost-free transactions while successfully upgrading and deploying OTA software patches in any system of CAVs. This paper extends our previous work [51] by analysing our proposed BC framework's immutability and load management capability. Our simulation results show that our proposed framework is robust, secure, and failsafe for CAV manufacturers and end-users.

CPVD: Cross Project Vulnerability Detection Based on Graph Attention Network and Domain Adaptation

Code vulnerability detection is critical for software security prevention. Vulnerability annotation in large-scale software code is quite tedious and challenging, which requires domain experts to spend a lot of time annotating. This work offers CPVD, a cross-domain vulnerability detection approach based on the challenge of ”learning to predict the vulnerability labels of another item quickly using one item with rich vulnerability labels.” CPVD uses the code property graph to represent the code and uses the Graph Attention Network and Convolution Pooling Network to extract the graph feature vector. It reduces the distribution between the source domain and target domain data in the Domain Adaptation Representation Learning stage for cross-domain vulnerability detection. In this paper, we test each other on different real-world project codes. Compared with methods without domain adaptation and domain adaptation methods based on natural language processing, CPVD is more general and performs better in cross-domain vulnerability detection tasks. Specifically, for the four datasets of chr_deb, qemu, libav, and sard, they achieved the best results of 70.2%, 81.1%, 59.7%, and 78.1% respectively on the F1-Score, and 88.4%,86.3%, 85.2%, and 88.6% on the AUC.

A Study of The Effectiveness of Code Review in Detecting Security Vulnerabilities

Software flaws pose a severe danger to the security and privacy of computer systems and the people who use them [1]. For software systems to be reliable and available, vulnerabilities must be found and fixed before they may be used against the system [2]. Two popular methods for finding weaknesses in software systems are code review and penetration testing [3]. Which method is better for identifying vulnerabilities, nevertheless, is not widely agreed upon [4]. The usefulness of code reviews and penetration tests in locating vulnerabilities is reviewed in detail in this study. We evaluate much empirical research [5] and contrast the benefits and drawbacks of each method. According to our research, both code reviews and penetration tests are useful for uncovering vulnerabilities [6], despite the fact that their effectiveness varies based on the kind of vulnerability, the complexity of the code, and the testers' or reviewers' experience [7][8]. Additionally, we discovered that doing both penetration testing and code review together may be more efficient than using each approach alone [9]. These results may help software engineers, security experts, and researchers choose and use the right approach for locating weaknesses in software systems.

Revisit security in the era of DevOps: An evidence‐based inquiry into DevSecOps industry

AbstractBy adopting agile and lean practices, DevOps aims to achieve rapid value delivery by speeding up development and deployment cycles, which however lead to more security concerns that cannot be fully addressed by an isolated security role only in the final stage of development. DevSecOps promotes security as a shared responsibility integrated into the DevOps process that seamlessly intertwines development, operations, and security from the start throughout to the end of cycles. While some companies have already begun to embrace this new strategy, both industry and academia are still seeking a common understanding of the DevSecOps movement. The goal of this study is to report the state‐of‐the‐practice of DevSecOps, including the impact of DevOps on security, practitioners' understanding of DevSecOps, and the practices associated with DevSecOps as well as the challenges of implementing DevSecOps. The authors used a mixed‐methods approach for this research. The authors carried out a grey literature review on DevSecOps, and surveyed the practitioners of DevSecOps in industry of China. The status quo of DevSecOps in industry is summarized. Three major software security risks are identified with DevOps, where the establishment of DevOps pipeline provides opportunities for security‐related activities. The authors classify the interpretations of DevSecOps into three core aspects of DevSecOps capabilities, cultural enablers, and technological enablers. To materialise the interpretations into daily software production activities, the recommended DevSecOps practices from three perspectives—people, process, and technology. Although a preliminary consensus is that DevSecOps is regarded as an extension of DevOps, there is a debate on whether DevSecOps is a superfluous term. While DevSecOps is attracting an increasing attention by industry, it is still in its infancy and more effort needs to be invested to promote it in both research and industry communities.

Strategies Leveraging AI in Devsecops for Cloud Environments

This paper aims to review how AI can be implemented in DevSecOps for cloud environments for the improvement of security across the SDLC. Authenticated automation, predictive analytics, and detecting threats are significant in realizing the cloud-native applications’ complexity and speed. Some of the focused strategies are AI in Security Testing, AI Powered Vulnerability Management, and AI in Compliance with regular and deeper security checks against the latest threats that might threaten the system. Subsequent trends reveal factors that define the utilization of AI in threat intelligence as well as prediction for secure software development in the future. The paper presents continuity of security as an important aspect of cloud application development with the emphasis on AI’s contributions to it.

Guest Editorial: Machine learning applied to quality and security in software systems

Guest Editorial: Machine learning applied to quality and security in software systems

Seeing is not always believing: Insights on IoT manufacturing from firmware composition analysis and vendor survey

Attacks on Internet of Things (IoT) devices have become increasingly sophisticated. However, there exist few comprehensive security investigations of IoT devices. We conducted a large-scale systematic investigation by assessing IoT firmware and follow-up survey with professionals involved in IoT-device manufacturing to understand the factors that prevent software security of IoT devices. Consequently, we discovered that many IoT devices continue to use old processor architecture and operating systems that are unable to efficiently use existing attack-mitigation features. Furthermore, we demonstrated that software patches are sometimes implicitly applied without changing the software version number (implicit patching); this may generate false positives in existing vulnerability assessments relying on software versions. On the basis of a follow-up survey, we determined technical and contractual constraints to IoT security emanating from the supply chain in the IoT device manufacturing industry. Based on the results, we discuss challenges associated with secure IoT manufacturing in the IoT-device supply chain.

Exploitation of Vulnerabilities: A Topic-Based Machine Learning Framework for Explaining and Predicting Exploitation

Security vulnerabilities constitute one of the most important weaknesses of hardware and software security that can cause severe damage to systems, applications, and users. As a result, software vendors should prioritize the most dangerous and impactful security vulnerabilities by developing appropriate countermeasures. As we acknowledge the importance of vulnerability prioritization, in the present study, we propose a framework that maps newly disclosed vulnerabilities with topic distributions, via word clustering, and further predicts whether this new entry will be associated with a potential exploit Proof Of Concept (POC). We also provide insights on the current most exploitable weaknesses and products through a Generalized Linear Model (GLM) that links the topic memberships of vulnerabilities with exploit indicators, thus distinguishing five topics that are associated with relatively frequent recent exploits. Our experiments show that the proposed framework can outperform two baseline topic modeling algorithms in terms of topic coherence by improving LDA models by up to 55%. In terms of classification performance, the conducted experiments—on a quite balanced dataset (57% negative observations, 43% positive observations)—indicate that the vulnerability descriptions can be used as exclusive features in assessing the exploitability of vulnerabilities, as the “best” model achieves accuracy close to 87%. Overall, our study contributes to enabling the prioritization of vulnerabilities by providing guidelines on the relations between the textual details of a weakness and the potential application/system exploits.